Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

8
  • 2
    Can you reverse it? I wasn't aware that MD5 was broken that heavily. Commented Jan 12, 2010 at 3:37
  • waiwai933 - look up "rainbow tables" to see the full extent of the problem. Commented Jan 12, 2010 at 3:44
  • 1
    Actually, that brings up an interesting point. Are gravatar ids just hashes of the emails? Do they even salt them? Commented Jan 12, 2010 at 3:46
  • 3
    I upvote this, cause it would make it easier to prove that gravatars are a security risk. Commented Jan 12, 2010 at 3:58
  • So not actually reversing the encryption. I thought for a moment there, that the algorithm had been broken. Commented Jan 12, 2010 at 4:04
  • 1
    There is a long discussion on SO about this. While you can't reverse them and rainbow tables won't help that much (after all, there are infinite input combinations for each hash), you can use them to guess e-Mails. Take the username or firstname and lastname and some well known mail provider addresses like gmail.com, hotmail.com etc. and then just try out many combinations. That works often. Not always of course, but it can easily get hundreds of valid addresses. Commented Jan 12, 2010 at 4:15
  • 5
    This guy has had some success gleaning email addresses from Stack Overflow based on the Gravatar hash: developer.it/post/… (summary: 8597 addresses, or ~10% of those scraped). While I normally might be against including the email hash, I think the cat's sufficiently out of the bag that it might do more good than further harm. Commented Jan 12, 2010 at 5:04
  • 1
    @Michael Can you provide a link to that discussion? Commented Jan 13, 2010 at 8:31